@payloadcms/plugin-stripe 4.0.0-canary.34 → 4.0.0-canary.36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-stripe",
-  "version": "4.0.0-canary.34",
+  "version": "4.0.0-canary.36",
   "description": "Stripe plugin for Payload",
   "keywords": [
     "payload",
@@ -55,19 +55,19 @@
     "lodash.get": "^4.4.2",
     "stripe": "^10.2.0",
     "uuid": "14.0.0",
-    "@payloadcms/translations": "4.0.0-canary.34",
-    "@payloadcms/ui": "4.0.0-canary.34"
+    "@payloadcms/translations": "4.0.0-canary.36",
+    "@payloadcms/ui": "4.0.0-canary.36"
   },
   "devDependencies": {
     "@types/lodash.get": "^4.4.7",
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
-    "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-canary.34",
-    "@payloadcms/next": "4.0.0-canary.34"
+    "@payloadcms/next": "4.0.0-canary.36",
+    "payload": "4.0.0-canary.36",
+    "@payloadcms/eslint-config": "3.28.0"
   },
   "peerDependencies": {
-    "payload": "4.0.0-canary.34"
+    "payload": "4.0.0-canary.36"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/"
@@ -79,7 +79,7 @@
     "build:swc": "swc ./src -d ./dist --config-file .swcrc --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --outDir dist",
     "clean": "rimraf -g {dist,*.tsbuildinfo}",
-    "copyfiles": "copyfiles -u 1 \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
+    "copyfiles": "copyfiles -u 1 -e \"**/*.spec.*\" \"src/**/*.{html,css,scss,ttf,woff,woff2,eot,svg,jpg,png,json}\" dist/",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix"
   }

package/dist/index.spec.js

@@ -1,73 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { stripePlugin } from './index.js';
-const createBaseConfig = ()=>({
-        collections: []
-    });
-const getStripeRESTEndpoints = async (pluginConfig)=>{
-    const transformedConfig = await stripePlugin(pluginConfig)(createBaseConfig());
-    return transformedConfig.endpoints?.filter(({ path })=>path === '/stripe/rest') ?? [];
-};
-describe('stripePlugin REST endpoint registration', ()=>{
-    it('should not register the REST endpoint when the option is absent', async ()=>{
-        const endpoints = await getStripeRESTEndpoints({
-            stripeSecretKey: 'sk_test_example'
-        });
-        expect(endpoints).toHaveLength(0);
-    });
-    it('should treat false from an untyped configuration as disabled', async ()=>{
-        const endpoints = await getStripeRESTEndpoints({
-            // @ts-expect-error -- omission is the supported way to disable the endpoint.
-            rest: false,
-            stripeSecretKey: 'sk_test_example'
-        });
-        expect(endpoints).toHaveLength(0);
-    });
-    it('should register exactly one POST endpoint for a valid REST configuration', async ()=>{
-        const endpoints = await getStripeRESTEndpoints({
-            rest: {
-                allowedMethods: [
-                    'subscriptions.list'
-                ]
-            },
-            stripeSecretKey: 'sk_test_example'
-        });
-        expect(endpoints).toHaveLength(1);
-        expect(endpoints[0]?.method).toBe('post');
-    });
-    it.each([
-        [
-            'the legacy boolean form',
-            true
-        ],
-        [
-            'an empty allowlist',
-            {
-                allowedMethods: []
-            }
-        ],
-        [
-            'a wildcard method',
-            {
-                allowedMethods: [
-                    'subscriptions.*'
-                ]
-            }
-        ],
-        [
-            'a non-string method',
-            {
-                allowedMethods: [
-                    123
-                ]
-            }
-        ]
-    ])('should reject %s during plugin transformation', async (_description, rest)=>{
-        const invalidConfig = {
-            rest,
-            stripeSecretKey: 'sk_test_example'
-        };
-        expect(()=>stripePlugin(invalidConfig)(createBaseConfig())).toThrow('The Stripe REST endpoint now requires an object with a non-empty allowedMethods array');
-    });
-});
-
-//# sourceMappingURL=index.spec.js.map

package/dist/index.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.spec.ts"],"sourcesContent":["import type { Config } from 'payload'\n\nimport { describe, expect, it } from 'vitest'\n\nimport type { StripePluginConfig } from './types.js'\n\nimport { stripePlugin } from './index.js'\n\nconst createBaseConfig = (): Config => ({ collections: [] })\n\nconst getStripeRESTEndpoints = async (pluginConfig: StripePluginConfig) => {\n  const transformedConfig = await stripePlugin(pluginConfig)(createBaseConfig())\n\n  return transformedConfig.endpoints?.filter(({ path }) => path === '/stripe/rest') ?? []\n}\n\ndescribe('stripePlugin REST endpoint registration', () => {\n  it('should not register the REST endpoint when the option is absent', async () => {\n    const endpoints = await getStripeRESTEndpoints({ stripeSecretKey: 'sk_test_example' })\n\n    expect(endpoints).toHaveLength(0)\n  })\n\n  it('should treat false from an untyped configuration as disabled', async () => {\n    const endpoints = await getStripeRESTEndpoints({\n      // @ts-expect-error -- omission is the supported way to disable the endpoint.\n      rest: false,\n      stripeSecretKey: 'sk_test_example',\n    })\n\n    expect(endpoints).toHaveLength(0)\n  })\n\n  it('should register exactly one POST endpoint for a valid REST configuration', async () => {\n    const endpoints = await getStripeRESTEndpoints({\n      rest: { allowedMethods: ['subscriptions.list'] },\n      stripeSecretKey: 'sk_test_example',\n    })\n\n    expect(endpoints).toHaveLength(1)\n    expect(endpoints[0]?.method).toBe('post')\n  })\n\n  it.each([\n    ['the legacy boolean form', true],\n    ['an empty allowlist', { allowedMethods: [] }],\n    ['a wildcard method', { allowedMethods: ['subscriptions.*'] }],\n    ['a non-string method', { allowedMethods: [123] }],\n  ])('should reject %s during plugin transformation', async (_description, rest) => {\n    const invalidConfig = {\n      rest,\n      stripeSecretKey: 'sk_test_example',\n    } as unknown as StripePluginConfig\n\n    expect(() => stripePlugin(invalidConfig)(createBaseConfig())).toThrow(\n      'The Stripe REST endpoint now requires an object with a non-empty allowedMethods array',\n    )\n  })\n})\n"],"names":["describe","expect","it","stripePlugin","createBaseConfig","collections","getStripeRESTEndpoints","pluginConfig","transformedConfig","endpoints","filter","path","stripeSecretKey","toHaveLength","rest","allowedMethods","method","toBe","each","_description","invalidConfig","toThrow"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,YAAY,QAAQ,aAAY;AAEzC,MAAMC,mBAAmB,IAAe,CAAA;QAAEC,aAAa,EAAE;IAAC,CAAA;AAE1D,MAAMC,yBAAyB,OAAOC;IACpC,MAAMC,oBAAoB,MAAML,aAAaI,cAAcH;IAE3D,OAAOI,kBAAkBC,SAAS,EAAEC,OAAO,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAAS,mBAAmB,EAAE;AACzF;AAEAX,SAAS,2CAA2C;IAClDE,GAAG,mEAAmE;QACpE,MAAMO,YAAY,MAAMH,uBAAuB;YAAEM,iBAAiB;QAAkB;QAEpFX,OAAOQ,WAAWI,YAAY,CAAC;IACjC;IAEAX,GAAG,gEAAgE;QACjE,MAAMO,YAAY,MAAMH,uBAAuB;YAC7C,6EAA6E;YAC7EQ,MAAM;YACNF,iBAAiB;QACnB;QAEAX,OAAOQ,WAAWI,YAAY,CAAC;IACjC;IAEAX,GAAG,4EAA4E;QAC7E,MAAMO,YAAY,MAAMH,uBAAuB;YAC7CQ,MAAM;gBAAEC,gBAAgB;oBAAC;iBAAqB;YAAC;YAC/CH,iBAAiB;QACnB;QAEAX,OAAOQ,WAAWI,YAAY,CAAC;QAC/BZ,OAAOQ,SAAS,CAAC,EAAE,EAAEO,QAAQC,IAAI,CAAC;IACpC;IAEAf,GAAGgB,IAAI,CAAC;QACN;YAAC;YAA2B;SAAK;QACjC;YAAC;YAAsB;gBAAEH,gBAAgB,EAAE;YAAC;SAAE;QAC9C;YAAC;YAAqB;gBAAEA,gBAAgB;oBAAC;iBAAkB;YAAC;SAAE;QAC9D;YAAC;YAAuB;gBAAEA,gBAAgB;oBAAC;iBAAI;YAAC;SAAE;KACnD,EAAE,iDAAiD,OAAOI,cAAcL;QACvE,MAAMM,gBAAgB;YACpBN;YACAF,iBAAiB;QACnB;QAEAX,OAAO,IAAME,aAAaiB,eAAehB,qBAAqBiB,OAAO,CACnE;IAEJ;AACF"}

package/dist/routes/rest.spec.js

@@ -1,275 +0,0 @@
-import { UnauthorizedError } from 'payload';
-import { beforeEach, describe, expect, it, vi } from 'vitest';
-const mocks = vi.hoisted(()=>({
-        addDataAndFileToRequest: vi.fn(),
-        canAccessAdmin: vi.fn(),
-        stripeProxy: vi.fn()
-    }));
-vi.mock('payload', async (importOriginal)=>{
-    const payload = await importOriginal();
-    return {
-        ...payload,
-        addDataAndFileToRequest: mocks.addDataAndFileToRequest,
-        canAccessAdmin: mocks.canAccessAdmin
-    };
-});
-vi.mock('../utilities/stripeProxy.js', ()=>({
-        stripeProxy: mocks.stripeProxy
-    }));
-import { stripeREST } from './rest.js';
-const loggerError = vi.fn();
-const createPluginConfig = ({ access } = {})=>({
-        rest: {
-            access,
-            allowedMethods: [
-                'subscriptions.list'
-            ]
-        },
-        stripeSecretKey: 'sk_test_example',
-        sync: []
-    });
-const createRequest = ({ stripeArgs = [], stripeMethod = 'subscriptions.list', user = {
-    collection: 'users',
-    id: 'user-1'
-} } = {})=>({
-        data: {
-            stripeArgs,
-            stripeMethod
-        },
-        payload: {
-            logger: {
-                error: loggerError
-            }
-        },
-        user
-    });
-describe('stripeREST', ()=>{
-    beforeEach(()=>{
-        vi.clearAllMocks();
-        mocks.addDataAndFileToRequest.mockResolvedValue(undefined);
-        mocks.canAccessAdmin.mockResolvedValue(undefined);
-        mocks.stripeProxy.mockResolvedValue({
-            data: {
-                id: 'sub_123'
-            },
-            status: 200
-        });
-    });
-    it('should return 401 for an anonymous request without invoking Stripe', async ()=>{
-        const req = createRequest({
-            user: null
-        });
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(401);
-        expect(mocks.addDataAndFileToRequest).toHaveBeenCalledWith(req);
-        expect(mocks.canAccessAdmin).not.toHaveBeenCalled();
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should return 403 when default admin access denies the user', async ()=>{
-        mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError());
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(403);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should return a generic 500 when default admin access throws unexpectedly', async ()=>{
-        const adminAccessError = new Error('sensitive admin access detail');
-        mocks.canAccessAdmin.mockRejectedValue(adminAccessError);
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        const body = await response.json();
-        expect(response.status).toBe(500);
-        expect(body).toEqual({
-            message: 'Internal server error'
-        });
-        expect(JSON.stringify(body)).not.toContain('sensitive admin access detail');
-        expect(loggerError).toHaveBeenCalledWith({
-            err: adminAccessError,
-            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
-        });
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should invoke an exactly listed method for an admin user', async ()=>{
-        const req = createRequest({
-            stripeArgs: [
-                {
-                    limit: 10
-                }
-            ]
-        });
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(200);
-        expect(mocks.stripeProxy).toHaveBeenCalledWith({
-            stripeArgs: [
-                {
-                    limit: 10
-                }
-            ],
-            stripeMethod: 'subscriptions.list',
-            stripeSecretKey: 'sk_test_example'
-        });
-    });
-    it('should allow a non-admin when an asynchronous custom access callback permits it', async ()=>{
-        const access = vi.fn(async ()=>true);
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig({
-                access
-            }),
-            req
-        });
-        expect(response.status).toBe(200);
-        expect(access).toHaveBeenCalledWith({
-            req
-        });
-        expect(mocks.canAccessAdmin).not.toHaveBeenCalled();
-    });
-    it('should return 403 when custom access denies the user', async ()=>{
-        const access = vi.fn(async ()=>false);
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig({
-                access
-            }),
-            req
-        });
-        expect(response.status).toBe(403);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should return a generic 500 when custom access throws', async ()=>{
-        const access = vi.fn(async ()=>{
-            throw new Error('sensitive access detail');
-        });
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig({
-                access
-            }),
-            req
-        });
-        const body = await response.text();
-        expect(response.status).toBe(500);
-        expect(body).not.toContain('sensitive access detail');
-        expect(loggerError).toHaveBeenCalledWith({
-            err: expect.any(Error),
-            msg: 'An unexpected error occurred in the Stripe plugin REST handler.'
-        });
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it.each([
-        'customers.list',
-        'subscriptions.cancel',
-        'subscriptions.*'
-    ])('should return 400 for unlisted method %s without invoking Stripe', async (stripeMethod)=>{
-        const req = createRequest({
-            stripeMethod
-        });
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(400);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it.each([
-        [
-            ''
-        ],
-        [
-            '   '
-        ],
-        [
-            123
-        ],
-        [
-            null
-        ]
-    ])('should return 400 for malformed method %s without invoking Stripe', async (stripeMethod)=>{
-        const req = createRequest({
-            stripeMethod
-        });
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(400);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should return 400 for a missing method without invoking Stripe', async ()=>{
-        const req = createRequest();
-        delete req.data?.stripeMethod;
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(400);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should return 400 for non-array Stripe arguments without invoking Stripe', async ()=>{
-        const req = createRequest({
-            stripeArgs: {
-                limit: 10
-            }
-        });
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(400);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should evaluate access before revealing whether a method is listed', async ()=>{
-        mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError());
-        const req = createRequest({
-            stripeMethod: 'customers.delete'
-        });
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(403);
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-    it('should preserve the Stripe proxy response status and body after all guards pass', async ()=>{
-        mocks.stripeProxy.mockResolvedValue({
-            message: 'Stripe request failed',
-            status: 404
-        });
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        expect(response.status).toBe(404);
-        expect(await response.json()).toEqual({
-            message: 'Stripe request failed',
-            status: 404
-        });
-    });
-    it('should return a generic 500 when request parsing fails', async ()=>{
-        mocks.addDataAndFileToRequest.mockRejectedValue(new Error('sensitive parser detail'));
-        const req = createRequest();
-        const response = await stripeREST({
-            pluginConfig: createPluginConfig(),
-            req
-        });
-        const body = await response.text();
-        expect(response.status).toBe(500);
-        expect(body).not.toContain('sensitive parser detail');
-        expect(mocks.stripeProxy).not.toHaveBeenCalled();
-    });
-});
-
-//# sourceMappingURL=rest.spec.js.map

package/dist/routes/rest.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/routes/rest.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { UnauthorizedError } from 'payload'\nimport { beforeEach, describe, expect, it, vi } from 'vitest'\n\nimport type { SanitizedStripePluginConfig, StripeRESTAccess } from '../types.js'\n\nconst mocks = vi.hoisted(() => ({\n  addDataAndFileToRequest: vi.fn(),\n  canAccessAdmin: vi.fn(),\n  stripeProxy: vi.fn(),\n}))\n\nvi.mock('payload', async (importOriginal) => {\n  const payload = await importOriginal<typeof import('payload')>()\n\n  return {\n    ...payload,\n    addDataAndFileToRequest: mocks.addDataAndFileToRequest,\n    canAccessAdmin: mocks.canAccessAdmin,\n  }\n})\n\nvi.mock('../utilities/stripeProxy.js', () => ({\n  stripeProxy: mocks.stripeProxy,\n}))\n\nimport { stripeREST } from './rest.js'\n\nconst loggerError = vi.fn()\n\nconst createPluginConfig = ({\n  access,\n}: {\n  access?: StripeRESTAccess\n} = {}): SanitizedStripePluginConfig => ({\n  rest: {\n    access,\n    allowedMethods: ['subscriptions.list'],\n  },\n  stripeSecretKey: 'sk_test_example',\n  sync: [],\n})\n\nconst createRequest = ({\n  stripeArgs = [],\n  stripeMethod = 'subscriptions.list',\n  user = { collection: 'users', id: 'user-1' },\n}: {\n  stripeArgs?: unknown\n  stripeMethod?: unknown\n  user?: null | { collection: string; id: string }\n} = {}): PayloadRequest =>\n  ({\n    data: { stripeArgs, stripeMethod },\n    payload: {\n      logger: { error: loggerError },\n    },\n    user,\n  }) as unknown as PayloadRequest\n\ndescribe('stripeREST', () => {\n  beforeEach(() => {\n    vi.clearAllMocks()\n    mocks.addDataAndFileToRequest.mockResolvedValue(undefined)\n    mocks.canAccessAdmin.mockResolvedValue(undefined)\n    mocks.stripeProxy.mockResolvedValue({ data: { id: 'sub_123' }, status: 200 })\n  })\n\n  it('should return 401 for an anonymous request without invoking Stripe', async () => {\n    const req = createRequest({ user: null })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(401)\n    expect(mocks.addDataAndFileToRequest).toHaveBeenCalledWith(req)\n    expect(mocks.canAccessAdmin).not.toHaveBeenCalled()\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return 403 when default admin access denies the user', async () => {\n    mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError())\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return a generic 500 when default admin access throws unexpectedly', async () => {\n    const adminAccessError = new Error('sensitive admin access detail')\n\n    mocks.canAccessAdmin.mockRejectedValue(adminAccessError)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n    const body = await response.json()\n\n    expect(response.status).toBe(500)\n    expect(body).toEqual({ message: 'Internal server error' })\n    expect(JSON.stringify(body)).not.toContain('sensitive admin access detail')\n    expect(loggerError).toHaveBeenCalledWith({\n      err: adminAccessError,\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should invoke an exactly listed method for an admin user', async () => {\n    const req = createRequest({ stripeArgs: [{ limit: 10 }] })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(200)\n    expect(mocks.stripeProxy).toHaveBeenCalledWith({\n      stripeArgs: [{ limit: 10 }],\n      stripeMethod: 'subscriptions.list',\n      stripeSecretKey: 'sk_test_example',\n    })\n  })\n\n  it('should allow a non-admin when an asynchronous custom access callback permits it', async () => {\n    const access = vi.fn(async () => true)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(200)\n    expect(access).toHaveBeenCalledWith({ req })\n    expect(mocks.canAccessAdmin).not.toHaveBeenCalled()\n  })\n\n  it('should return 403 when custom access denies the user', async () => {\n    const access = vi.fn(async () => false)\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return a generic 500 when custom access throws', async () => {\n    const access = vi.fn(async () => {\n      throw new Error('sensitive access detail')\n    })\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig({ access }), req })\n    const body = await response.text()\n\n    expect(response.status).toBe(500)\n    expect(body).not.toContain('sensitive access detail')\n    expect(loggerError).toHaveBeenCalledWith({\n      err: expect.any(Error),\n      msg: 'An unexpected error occurred in the Stripe plugin REST handler.',\n    })\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it.each(['customers.list', 'subscriptions.cancel', 'subscriptions.*'])(\n    'should return 400 for unlisted method %s without invoking Stripe',\n    async (stripeMethod) => {\n      const req = createRequest({ stripeMethod })\n\n      const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n      expect(response.status).toBe(400)\n      expect(mocks.stripeProxy).not.toHaveBeenCalled()\n    },\n  )\n\n  it.each([[''], ['   '], [123], [null]])(\n    'should return 400 for malformed method %s without invoking Stripe',\n    async (stripeMethod) => {\n      const req = createRequest({ stripeMethod })\n\n      const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n      expect(response.status).toBe(400)\n      expect(mocks.stripeProxy).not.toHaveBeenCalled()\n    },\n  )\n\n  it('should return 400 for a missing method without invoking Stripe', async () => {\n    const req = createRequest()\n\n    delete req.data?.stripeMethod\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(400)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should return 400 for non-array Stripe arguments without invoking Stripe', async () => {\n    const req = createRequest({ stripeArgs: { limit: 10 } })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(400)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should evaluate access before revealing whether a method is listed', async () => {\n    mocks.canAccessAdmin.mockRejectedValue(new UnauthorizedError())\n    const req = createRequest({ stripeMethod: 'customers.delete' })\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(403)\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n\n  it('should preserve the Stripe proxy response status and body after all guards pass', async () => {\n    mocks.stripeProxy.mockResolvedValue({ message: 'Stripe request failed', status: 404 })\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n\n    expect(response.status).toBe(404)\n    expect(await response.json()).toEqual({ message: 'Stripe request failed', status: 404 })\n  })\n\n  it('should return a generic 500 when request parsing fails', async () => {\n    mocks.addDataAndFileToRequest.mockRejectedValue(new Error('sensitive parser detail'))\n    const req = createRequest()\n\n    const response = await stripeREST({ pluginConfig: createPluginConfig(), req })\n    const body = await response.text()\n\n    expect(response.status).toBe(500)\n    expect(body).not.toContain('sensitive parser detail')\n    expect(mocks.stripeProxy).not.toHaveBeenCalled()\n  })\n})\n"],"names":["UnauthorizedError","beforeEach","describe","expect","it","vi","mocks","hoisted","addDataAndFileToRequest","fn","canAccessAdmin","stripeProxy","mock","importOriginal","payload","stripeREST","loggerError","createPluginConfig","access","rest","allowedMethods","stripeSecretKey","sync","createRequest","stripeArgs","stripeMethod","user","collection","id","data","logger","error","clearAllMocks","mockResolvedValue","undefined","status","req","response","pluginConfig","toBe","toHaveBeenCalledWith","not","toHaveBeenCalled","mockRejectedValue","adminAccessError","Error","body","json","toEqual","message","JSON","stringify","toContain","err","msg","limit","text","any","each"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,UAAS;AAC3C,SAASC,UAAU,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAI7D,MAAMC,QAAQD,GAAGE,OAAO,CAAC,IAAO,CAAA;QAC9BC,yBAAyBH,GAAGI,EAAE;QAC9BC,gBAAgBL,GAAGI,EAAE;QACrBE,aAAaN,GAAGI,EAAE;IACpB,CAAA;AAEAJ,GAAGO,IAAI,CAAC,WAAW,OAAOC;IACxB,MAAMC,UAAU,MAAMD;IAEtB,OAAO;QACL,GAAGC,OAAO;QACVN,yBAAyBF,MAAME,uBAAuB;QACtDE,gBAAgBJ,MAAMI,cAAc;IACtC;AACF;AAEAL,GAAGO,IAAI,CAAC,+BAA+B,IAAO,CAAA;QAC5CD,aAAaL,MAAMK,WAAW;IAChC,CAAA;AAEA,SAASI,UAAU,QAAQ,YAAW;AAEtC,MAAMC,cAAcX,GAAGI,EAAE;AAEzB,MAAMQ,qBAAqB,CAAC,EAC1BC,MAAM,EAGP,GAAG,CAAC,CAAC,GAAmC,CAAA;QACvCC,MAAM;YACJD;YACAE,gBAAgB;gBAAC;aAAqB;QACxC;QACAC,iBAAiB;QACjBC,MAAM,EAAE;IACV,CAAA;AAEA,MAAMC,gBAAgB,CAAC,EACrBC,aAAa,EAAE,EACfC,eAAe,oBAAoB,EACnCC,OAAO;IAAEC,YAAY;IAASC,IAAI;AAAS,CAAC,EAK7C,GAAG,CAAC,CAAC,GACH,CAAA;QACCC,MAAM;YAAEL;YAAYC;QAAa;QACjCX,SAAS;YACPgB,QAAQ;gBAAEC,OAAOf;YAAY;QAC/B;QACAU;IACF,CAAA;AAEFxB,SAAS,cAAc;IACrBD,WAAW;QACTI,GAAG2B,aAAa;QAChB1B,MAAME,uBAAuB,CAACyB,iBAAiB,CAACC;QAChD5B,MAAMI,cAAc,CAACuB,iBAAiB,CAACC;QACvC5B,MAAMK,WAAW,CAACsB,iBAAiB,CAAC;YAAEJ,MAAM;gBAAED,IAAI;YAAU;YAAGO,QAAQ;QAAI;IAC7E;IAEA/B,GAAG,sEAAsE;QACvE,MAAMgC,MAAMb,cAAc;YAAEG,MAAM;QAAK;QAEvC,MAAMW,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAME,uBAAuB,EAAEgC,oBAAoB,CAACJ;QAC3DjC,OAAOG,MAAMI,cAAc,EAAE+B,GAAG,CAACC,gBAAgB;QACjDvC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,+DAA+D;QAChEE,MAAMI,cAAc,CAACiC,iBAAiB,CAAC,IAAI3C;QAC3C,MAAMoC,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,6EAA6E;QAC9E,MAAMwC,mBAAmB,IAAIC,MAAM;QAEnCvC,MAAMI,cAAc,CAACiC,iBAAiB,CAACC;QACvC,MAAMR,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAC5E,MAAMU,OAAO,MAAMT,SAASU,IAAI;QAEhC5C,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO2C,MAAME,OAAO,CAAC;YAAEC,SAAS;QAAwB;QACxD9C,OAAO+C,KAAKC,SAAS,CAACL,OAAOL,GAAG,CAACW,SAAS,CAAC;QAC3CjD,OAAOa,aAAawB,oBAAoB,CAAC;YACvCa,KAAKT;YACLU,KAAK;QACP;QACAnD,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,4DAA4D;QAC7D,MAAMgC,MAAMb,cAAc;YAAEC,YAAY;gBAAC;oBAAE+B,OAAO;gBAAG;aAAE;QAAC;QAExD,MAAMlB,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE6B,oBAAoB,CAAC;YAC7ChB,YAAY;gBAAC;oBAAE+B,OAAO;gBAAG;aAAE;YAC3B9B,cAAc;YACdJ,iBAAiB;QACnB;IACF;IAEAjB,GAAG,mFAAmF;QACpF,MAAMc,SAASb,GAAGI,EAAE,CAAC,UAAY;QACjC,MAAM2B,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOe,QAAQsB,oBAAoB,CAAC;YAAEJ;QAAI;QAC1CjC,OAAOG,MAAMI,cAAc,EAAE+B,GAAG,CAACC,gBAAgB;IACnD;IAEAtC,GAAG,wDAAwD;QACzD,MAAMc,SAASb,GAAGI,EAAE,CAAC,UAAY;QACjC,MAAM2B,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QAEtFjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,yDAAyD;QAC1D,MAAMc,SAASb,GAAGI,EAAE,CAAC;YACnB,MAAM,IAAIoC,MAAM;QAClB;QACA,MAAMT,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB,mBAAmB;gBAAEC;YAAO;YAAIkB;QAAI;QACtF,MAAMU,OAAO,MAAMT,SAASmB,IAAI;QAEhCrD,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO2C,MAAML,GAAG,CAACW,SAAS,CAAC;QAC3BjD,OAAOa,aAAawB,oBAAoB,CAAC;YACvCa,KAAKlD,OAAOsD,GAAG,CAACZ;YAChBS,KAAK;QACP;QACAnD,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAGsD,IAAI,CAAC;QAAC;QAAkB;QAAwB;KAAkB,EACnE,oEACA,OAAOjC;QACL,MAAMW,MAAMb,cAAc;YAAEE;QAAa;QAEzC,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAGFtC,GAAGsD,IAAI,CAAC;QAAC;YAAC;SAAG;QAAE;YAAC;SAAM;QAAE;YAAC;SAAI;QAAE;YAAC;SAAK;KAAC,EACpC,qEACA,OAAOjC;QACL,MAAMW,MAAMb,cAAc;YAAEE;QAAa;QAEzC,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAGFtC,GAAG,kEAAkE;QACnE,MAAMgC,MAAMb;QAEZ,OAAOa,IAAIP,IAAI,EAAEJ;QAEjB,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,4EAA4E;QAC7E,MAAMgC,MAAMb,cAAc;YAAEC,YAAY;gBAAE+B,OAAO;YAAG;QAAE;QAEtD,MAAMlB,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,sEAAsE;QACvEE,MAAMI,cAAc,CAACiC,iBAAiB,CAAC,IAAI3C;QAC3C,MAAMoC,MAAMb,cAAc;YAAEE,cAAc;QAAmB;QAE7D,MAAMY,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;IAEAtC,GAAG,mFAAmF;QACpFE,MAAMK,WAAW,CAACsB,iBAAiB,CAAC;YAAEgB,SAAS;YAAyBd,QAAQ;QAAI;QACpF,MAAMC,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAE5EjC,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO,MAAMkC,SAASU,IAAI,IAAIC,OAAO,CAAC;YAAEC,SAAS;YAAyBd,QAAQ;QAAI;IACxF;IAEA/B,GAAG,0DAA0D;QAC3DE,MAAME,uBAAuB,CAACmC,iBAAiB,CAAC,IAAIE,MAAM;QAC1D,MAAMT,MAAMb;QAEZ,MAAMc,WAAW,MAAMtB,WAAW;YAAEuB,cAAcrB;YAAsBmB;QAAI;QAC5E,MAAMU,OAAO,MAAMT,SAASmB,IAAI;QAEhCrD,OAAOkC,SAASF,MAAM,EAAEI,IAAI,CAAC;QAC7BpC,OAAO2C,MAAML,GAAG,CAACW,SAAS,CAAC;QAC3BjD,OAAOG,MAAMK,WAAW,EAAE8B,GAAG,CAACC,gBAAgB;IAChD;AACF"}

package/dist/utilities/deepen.spec.js

@@ -1,110 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { deepen, getSyncedFields } from './deepen.js';
-describe('Stripe field mappings', ()=>{
-    it('should build constrained mappings from owned values', ()=>{
-        const marker = 'constrainedStripeMapping';
-        const inheritedSource = 'constrainedStripeSource';
-        const originalDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, marker);
-        let inheritedGetterCalls = 0;
-        let processStateChanged = false;
-        let nestedMapping;
-        let syncedMapping;
-        let webhookMapping;
-        try {
-            expect(()=>deepen({
-                    [`__proto__.${marker}`]: 'value'
-                })).toThrow('Invalid field path.');
-            nestedMapping = deepen(Object.assign(Object.create({
-                'ignored.value': 'inherited'
-            }), {
-                [`constructor.prototype.${marker}`]: 'local',
-                'profile.displayName': 'Ada'
-            }));
-            const data = Object.create({
-                get [inheritedSource] () {
-                    inheritedGetterCalls += 1;
-                    return 'inherited';
-                }
-            });
-            data.displayName = 'Ada';
-            syncedMapping = getSyncedFields({
-                data,
-                fields: [
-                    {
-                        fieldPath: inheritedSource,
-                        stripeProperty: 'metadata.inherited'
-                    },
-                    {
-                        fieldPath: 'constructor',
-                        stripeProperty: 'constructor'
-                    },
-                    {
-                        fieldPath: 'displayName',
-                        stripeProperty: `constructor.prototype.${marker}`
-                    }
-                ],
-                source: 'payload'
-            });
-            const stripeData = Object.create({
-                get [inheritedSource] () {
-                    inheritedGetterCalls += 1;
-                    return 'inherited';
-                }
-            });
-            stripeData.name = 'Ada';
-            webhookMapping = getSyncedFields({
-                data: stripeData,
-                fields: [
-                    {
-                        fieldPath: 'profile.inherited',
-                        stripeProperty: inheritedSource
-                    },
-                    {
-                        fieldPath: 'profile.displayName',
-                        stripeProperty: 'name'
-                    }
-                ],
-                source: 'stripe'
-            });
-            processStateChanged = Object.hasOwn(Object.prototype, marker);
-        } finally{
-            if (originalDescriptor) {
-                Object.defineProperty(Object.prototype, marker, originalDescriptor);
-            } else {
-                delete Object.prototype[marker];
-            }
-        }
-        expect(processStateChanged).toBe(false);
-        expect(inheritedGetterCalls).toBe(0);
-        expect(Object.getOwnPropertyDescriptor(Object.prototype, marker)).toEqual(originalDescriptor);
-        expect(nestedMapping).toEqual({
-            constructor: {
-                prototype: {
-                    [marker]: 'local'
-                }
-            },
-            profile: {
-                displayName: 'Ada'
-            }
-        });
-        expect(Object.hasOwn(nestedMapping, 'ignored')).toBe(false);
-        expect(syncedMapping).toEqual({
-            constructor: {
-                prototype: {
-                    [marker]: 'Ada'
-                }
-            },
-            metadata: {
-                inherited: undefined
-            }
-        });
-        expect(webhookMapping).toEqual({
-            profile: {
-                displayName: 'Ada',
-                inherited: undefined
-            }
-        });
-    });
-});
-
-//# sourceMappingURL=deepen.spec.js.map

package/dist/utilities/deepen.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/deepen.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport { deepen, getSyncedFields } from './deepen.js'\n\ndescribe('Stripe field mappings', () => {\n  it('should build constrained mappings from owned values', () => {\n    const marker = 'constrainedStripeMapping'\n    const inheritedSource = 'constrainedStripeSource'\n    const originalDescriptor = Object.getOwnPropertyDescriptor(Object.prototype, marker)\n    let inheritedGetterCalls = 0\n    let processStateChanged = false\n    let nestedMapping: Record<string, unknown> | undefined\n    let syncedMapping: Record<string, unknown> | undefined\n    let webhookMapping: Record<string, unknown> | undefined\n\n    try {\n      expect(() => deepen({ [`__proto__.${marker}`]: 'value' })).toThrow('Invalid field path.')\n\n      nestedMapping = deepen(\n        Object.assign(Object.create({ 'ignored.value': 'inherited' }), {\n          [`constructor.prototype.${marker}`]: 'local',\n          'profile.displayName': 'Ada',\n        }),\n      )\n\n      const data = Object.create({\n        get [inheritedSource]() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }) as Record<string, unknown>\n      data.displayName = 'Ada'\n\n      syncedMapping = getSyncedFields({\n        data,\n        fields: [\n          { fieldPath: inheritedSource, stripeProperty: 'metadata.inherited' },\n          { fieldPath: 'constructor', stripeProperty: 'constructor' },\n          {\n            fieldPath: 'displayName',\n            stripeProperty: `constructor.prototype.${marker}`,\n          },\n        ],\n        source: 'payload',\n      })\n\n      const stripeData = Object.create({\n        get [inheritedSource]() {\n          inheritedGetterCalls += 1\n          return 'inherited'\n        },\n      }) as Record<string, unknown>\n      stripeData.name = 'Ada'\n\n      webhookMapping = getSyncedFields({\n        data: stripeData,\n        fields: [\n          { fieldPath: 'profile.inherited', stripeProperty: inheritedSource },\n          { fieldPath: 'profile.displayName', stripeProperty: 'name' },\n        ],\n        source: 'stripe',\n      })\n      processStateChanged = Object.hasOwn(Object.prototype, marker)\n    } finally {\n      if (originalDescriptor) {\n        Object.defineProperty(Object.prototype, marker, originalDescriptor)\n      } else {\n        delete (Object.prototype as Record<string, unknown>)[marker]\n      }\n    }\n\n    expect(processStateChanged).toBe(false)\n    expect(inheritedGetterCalls).toBe(0)\n    expect(Object.getOwnPropertyDescriptor(Object.prototype, marker)).toEqual(originalDescriptor)\n    expect(nestedMapping).toEqual({\n      constructor: {\n        prototype: {\n          [marker]: 'local',\n        },\n      },\n      profile: {\n        displayName: 'Ada',\n      },\n    })\n    expect(Object.hasOwn(nestedMapping as object, 'ignored')).toBe(false)\n    expect(syncedMapping).toEqual({\n      constructor: {\n        prototype: {\n          [marker]: 'Ada',\n        },\n      },\n      metadata: {\n        inherited: undefined,\n      },\n    })\n    expect(webhookMapping).toEqual({\n      profile: {\n        displayName: 'Ada',\n        inherited: undefined,\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","deepen","getSyncedFields","marker","inheritedSource","originalDescriptor","Object","getOwnPropertyDescriptor","prototype","inheritedGetterCalls","processStateChanged","nestedMapping","syncedMapping","webhookMapping","toThrow","assign","create","data","displayName","fields","fieldPath","stripeProperty","source","stripeData","name","hasOwn","defineProperty","toBe","toEqual","profile","metadata","inherited","undefined"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,MAAM,EAAEC,eAAe,QAAQ,cAAa;AAErDJ,SAAS,yBAAyB;IAChCE,GAAG,uDAAuD;QACxD,MAAMG,SAAS;QACf,MAAMC,kBAAkB;QACxB,MAAMC,qBAAqBC,OAAOC,wBAAwB,CAACD,OAAOE,SAAS,EAAEL;QAC7E,IAAIM,uBAAuB;QAC3B,IAAIC,sBAAsB;QAC1B,IAAIC;QACJ,IAAIC;QACJ,IAAIC;QAEJ,IAAI;YACFd,OAAO,IAAME,OAAO;oBAAE,CAAC,CAAC,UAAU,EAAEE,QAAQ,CAAC,EAAE;gBAAQ,IAAIW,OAAO,CAAC;YAEnEH,gBAAgBV,OACdK,OAAOS,MAAM,CAACT,OAAOU,MAAM,CAAC;gBAAE,iBAAiB;YAAY,IAAI;gBAC7D,CAAC,CAAC,sBAAsB,EAAEb,QAAQ,CAAC,EAAE;gBACrC,uBAAuB;YACzB;YAGF,MAAMc,OAAOX,OAAOU,MAAM,CAAC;gBACzB,IAAI,CAACZ,gBAAgB,IAAG;oBACtBK,wBAAwB;oBACxB,OAAO;gBACT;YACF;YACAQ,KAAKC,WAAW,GAAG;YAEnBN,gBAAgBV,gBAAgB;gBAC9Be;gBACAE,QAAQ;oBACN;wBAAEC,WAAWhB;wBAAiBiB,gBAAgB;oBAAqB;oBACnE;wBAAED,WAAW;wBAAeC,gBAAgB;oBAAc;oBAC1D;wBACED,WAAW;wBACXC,gBAAgB,CAAC,sBAAsB,EAAElB,QAAQ;oBACnD;iBACD;gBACDmB,QAAQ;YACV;YAEA,MAAMC,aAAajB,OAAOU,MAAM,CAAC;gBAC/B,IAAI,CAACZ,gBAAgB,IAAG;oBACtBK,wBAAwB;oBACxB,OAAO;gBACT;YACF;YACAc,WAAWC,IAAI,GAAG;YAElBX,iBAAiBX,gBAAgB;gBAC/Be,MAAMM;gBACNJ,QAAQ;oBACN;wBAAEC,WAAW;wBAAqBC,gBAAgBjB;oBAAgB;oBAClE;wBAAEgB,WAAW;wBAAuBC,gBAAgB;oBAAO;iBAC5D;gBACDC,QAAQ;YACV;YACAZ,sBAAsBJ,OAAOmB,MAAM,CAACnB,OAAOE,SAAS,EAAEL;QACxD,SAAU;YACR,IAAIE,oBAAoB;gBACtBC,OAAOoB,cAAc,CAACpB,OAAOE,SAAS,EAAEL,QAAQE;YAClD,OAAO;gBACL,OAAO,AAACC,OAAOE,SAAS,AAA4B,CAACL,OAAO;YAC9D;QACF;QAEAJ,OAAOW,qBAAqBiB,IAAI,CAAC;QACjC5B,OAAOU,sBAAsBkB,IAAI,CAAC;QAClC5B,OAAOO,OAAOC,wBAAwB,CAACD,OAAOE,SAAS,EAAEL,SAASyB,OAAO,CAACvB;QAC1EN,OAAOY,eAAeiB,OAAO,CAAC;YAC5B,aAAa;gBACXpB,WAAW;oBACT,CAACL,OAAO,EAAE;gBACZ;YACF;YACA0B,SAAS;gBACPX,aAAa;YACf;QACF;QACAnB,OAAOO,OAAOmB,MAAM,CAACd,eAAyB,YAAYgB,IAAI,CAAC;QAC/D5B,OAAOa,eAAegB,OAAO,CAAC;YAC5B,aAAa;gBACXpB,WAAW;oBACT,CAACL,OAAO,EAAE;gBACZ;YACF;YACA2B,UAAU;gBACRC,WAAWC;YACb;QACF;QACAjC,OAAOc,gBAAgBe,OAAO,CAAC;YAC7BC,SAAS;gBACPX,aAAa;gBACba,WAAWC;YACb;QACF;IACF;AACF"}

package/dist/utilities/sanitizeStripeRESTConfig.spec.js

@@ -1,116 +0,0 @@
-import { describe, expect, it, vi } from 'vitest';
-import { sanitizeStripeRESTConfig } from './sanitizeStripeRESTConfig.js';
-describe('sanitizeStripeRESTConfig', ()=>{
-    it('should disable the REST endpoint when configuration is absent', ()=>{
-        expect(sanitizeStripeRESTConfig({
-            rest: undefined
-        })).toBeUndefined();
-    });
-    it('should treat false from an untyped configuration as disabled', ()=>{
-        expect(sanitizeStripeRESTConfig({
-            rest: false
-        })).toBeUndefined();
-    });
-    it('should return a new configuration with exact, de-duplicated, frozen methods', ()=>{
-        const access = vi.fn(()=>true);
-        const rest = {
-            access,
-            allowedMethods: [
-                'subscriptions.list',
-                ' paymentIntents.retrieve ',
-                'subscriptions.list'
-            ]
-        };
-        const sanitized = sanitizeStripeRESTConfig({
-            rest
-        });
-        expect(sanitized).not.toBe(rest);
-        expect(sanitized).toEqual({
-            access,
-            allowedMethods: [
-                'subscriptions.list',
-                ' paymentIntents.retrieve '
-            ]
-        });
-        expect(Object.isFrozen(sanitized.allowedMethods)).toBe(true);
-    });
-    it.each([
-        [
-            'the legacy boolean form',
-            true
-        ],
-        [
-            'an array',
-            [
-                {
-                    allowedMethods: [
-                        'subscriptions.list'
-                    ]
-                }
-            ]
-        ],
-        [
-            'a missing allowlist',
-            {}
-        ],
-        [
-            'a non-array allowlist',
-            {
-                allowedMethods: 'subscriptions.list'
-            }
-        ],
-        [
-            'an empty allowlist',
-            {
-                allowedMethods: []
-            }
-        ],
-        [
-            'an empty method',
-            {
-                allowedMethods: [
-                    ''
-                ]
-            }
-        ],
-        [
-            'a whitespace-only method',
-            {
-                allowedMethods: [
-                    '   '
-                ]
-            }
-        ],
-        [
-            'a non-string method',
-            {
-                allowedMethods: [
-                    123
-                ]
-            }
-        ],
-        [
-            'a wildcard method',
-            {
-                allowedMethods: [
-                    'subscriptions.*'
-                ]
-            }
-        ],
-        [
-            'a non-function access value',
-            {
-                access: true,
-                allowedMethods: [
-                    'subscriptions.list'
-                ]
-            }
-        ]
-    ])('should reject %s', (_description, rest)=>{
-        expect(()=>sanitizeStripeRESTConfig({
-                rest
-            })).toThrow('The Stripe REST endpoint now requires an object with a non-empty allowedMethods array');
-    });
-});
-
-//# sourceMappingURL=sanitizeStripeRESTConfig.spec.js.map

package/dist/utilities/sanitizeStripeRESTConfig.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/utilities/sanitizeStripeRESTConfig.spec.ts"],"sourcesContent":["import { describe, expect, it, vi } from 'vitest'\n\nimport { sanitizeStripeRESTConfig } from './sanitizeStripeRESTConfig.js'\n\ndescribe('sanitizeStripeRESTConfig', () => {\n  it('should disable the REST endpoint when configuration is absent', () => {\n    expect(sanitizeStripeRESTConfig({ rest: undefined })).toBeUndefined()\n  })\n\n  it('should treat false from an untyped configuration as disabled', () => {\n    expect(sanitizeStripeRESTConfig({ rest: false })).toBeUndefined()\n  })\n\n  it('should return a new configuration with exact, de-duplicated, frozen methods', () => {\n    const access = vi.fn(() => true)\n    const rest = {\n      access,\n      allowedMethods: ['subscriptions.list', ' paymentIntents.retrieve ', 'subscriptions.list'],\n    } as const\n\n    const sanitized = sanitizeStripeRESTConfig({ rest })\n\n    expect(sanitized).not.toBe(rest)\n    expect(sanitized).toEqual({\n      access,\n      allowedMethods: ['subscriptions.list', ' paymentIntents.retrieve '],\n    })\n    expect(Object.isFrozen(sanitized.allowedMethods)).toBe(true)\n  })\n\n  it.each([\n    ['the legacy boolean form', true],\n    ['an array', [{ allowedMethods: ['subscriptions.list'] }]],\n    ['a missing allowlist', {}],\n    ['a non-array allowlist', { allowedMethods: 'subscriptions.list' }],\n    ['an empty allowlist', { allowedMethods: [] }],\n    ['an empty method', { allowedMethods: [''] }],\n    ['a whitespace-only method', { allowedMethods: ['   '] }],\n    ['a non-string method', { allowedMethods: [123] }],\n    ['a wildcard method', { allowedMethods: ['subscriptions.*'] }],\n    ['a non-function access value', { access: true, allowedMethods: ['subscriptions.list'] }],\n  ])('should reject %s', (_description, rest) => {\n    expect(() => sanitizeStripeRESTConfig({ rest })).toThrow(\n      'The Stripe REST endpoint now requires an object with a non-empty allowedMethods array',\n    )\n  })\n})\n"],"names":["describe","expect","it","vi","sanitizeStripeRESTConfig","rest","undefined","toBeUndefined","access","fn","allowedMethods","sanitized","not","toBe","toEqual","Object","isFrozen","each","_description","toThrow"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAEjD,SAASC,wBAAwB,QAAQ,gCAA+B;AAExEJ,SAAS,4BAA4B;IACnCE,GAAG,iEAAiE;QAClED,OAAOG,yBAAyB;YAAEC,MAAMC;QAAU,IAAIC,aAAa;IACrE;IAEAL,GAAG,gEAAgE;QACjED,OAAOG,yBAAyB;YAAEC,MAAM;QAAM,IAAIE,aAAa;IACjE;IAEAL,GAAG,+EAA+E;QAChF,MAAMM,SAASL,GAAGM,EAAE,CAAC,IAAM;QAC3B,MAAMJ,OAAO;YACXG;YACAE,gBAAgB;gBAAC;gBAAsB;gBAA6B;aAAqB;QAC3F;QAEA,MAAMC,YAAYP,yBAAyB;YAAEC;QAAK;QAElDJ,OAAOU,WAAWC,GAAG,CAACC,IAAI,CAACR;QAC3BJ,OAAOU,WAAWG,OAAO,CAAC;YACxBN;YACAE,gBAAgB;gBAAC;gBAAsB;aAA4B;QACrE;QACAT,OAAOc,OAAOC,QAAQ,CAACL,UAAUD,cAAc,GAAGG,IAAI,CAAC;IACzD;IAEAX,GAAGe,IAAI,CAAC;QACN;YAAC;YAA2B;SAAK;QACjC;YAAC;YAAY;gBAAC;oBAAEP,gBAAgB;wBAAC;qBAAqB;gBAAC;aAAE;SAAC;QAC1D;YAAC;YAAuB,CAAC;SAAE;QAC3B;YAAC;YAAyB;gBAAEA,gBAAgB;YAAqB;SAAE;QACnE;YAAC;YAAsB;gBAAEA,gBAAgB,EAAE;YAAC;SAAE;QAC9C;YAAC;YAAmB;gBAAEA,gBAAgB;oBAAC;iBAAG;YAAC;SAAE;QAC7C;YAAC;YAA4B;gBAAEA,gBAAgB;oBAAC;iBAAM;YAAC;SAAE;QACzD;YAAC;YAAuB;gBAAEA,gBAAgB;oBAAC;iBAAI;YAAC;SAAE;QAClD;YAAC;YAAqB;gBAAEA,gBAAgB;oBAAC;iBAAkB;YAAC;SAAE;QAC9D;YAAC;YAA+B;gBAAEF,QAAQ;gBAAME,gBAAgB;oBAAC;iBAAqB;YAAC;SAAE;KAC1F,EAAE,oBAAoB,CAACQ,cAAcb;QACpCJ,OAAO,IAAMG,yBAAyB;gBAAEC;YAAK,IAAIc,OAAO,CACtD;IAEJ;AACF"}